Man Linux: Main Page and Category List


       ext3grep - ext3 file recovery tool


       ext3grep [OPTIONS] FILE ...


       ext3grep  is  a  simple  tool  intended  to aid anyone who accidentally
       deletes a file on an ext3 filesystem, only to find that they wanted  it
       shortly thereafter.


           Print  contents of superblock in addition to the rest. If no action
           is specified then this option is implied.

           Print contents of block or inode, if any.

           Print directories, one line per entry. See the FILTERS section  for
           details on filtering this output.

       --accept FILE
           Accepts  ’file’ as a legal filename. Can be used multiple times. If
           you change any --accept you must remove BOTH stage* files!

           Prints the contents of the journal.

           Show the inode of each directory component in paths.

       --group gid
           Only show/process files owned by process group gid.

           Only show/process process directory inodes.

       --after dtime
           Only show/process entries deleted on or after dtime.

       --before dtime
           Only show/process entries deleted before dtime.

           Only show/process deleted entries.

           Only show/process allocated inodes/blocks.

           Only show/process unallocated inodes/blocks.

           Do  not  suppress  entries  with  reallocated  inodes.  Inodes  are
           considered  ’reallocated’  if the entry is deleted but the inode is
           allocated, but also when the file type in the  dir  entry  and  the
           inode are different.

           Do  not  suppress  entries  with  zeroed inodes. Linked entries are
           always shown, regardless of this option.

       --depth depth
           Process directories recursively up till a depth of ’depth’.

       --inode-to-block inode_num
           Print the block that contains inode inode_num.

       --inode inode_num
           Show info on inode inode_num. If --ls is used and the  inode  is  a
           directory,  then the filters apply to the entries of the directory.
           If you do not use --ls then --print is implied.

       --block block_num
           Show info on block block_num. If --ls is used and the block is  the
           first  block  of  a directory, then the filters apply to entries of
           the directory. If you do not use --ls then --print is implied.

           Generate a histogram based on the given specs. Using  atime,  ctime
           or  mtime  will change the meaning of --after and --before to those

       --journal-block block_num
           Show info on journal block block_num.

       --journal-transaction seq
           Show info on transaction with sequence number seq.

           Write  the  paths  of  files  to  stdout.  This  implies  --ls  but
           suppresses its output.

       --search-start str
           Find blocks that start with the fixed string str.

       --search str
           Find blocks that contain the fixed string str.

       --search-inode block_num
           Find inodes that refer to block block_num.

           Return allocated inode table entries that are zeroed.

       --inode-dirblock-table dir
           Print  a  table  for  directory path dir of directory block numbers
           found and the inodes used for each file.

       --show-journal-inodes inode_num
           Show copies of inode inode_num still in the journal.

       --restore-file path
           Will restore file path. path is relative to root of  the  partition
           and does not start with a ’/’ (it must be one of the paths returned
           by --dump-names). The restored directory, file or symbolic link  is
           created in the current directory as ./path.

           As  --restore-file  but  attempts to restore everything. The use of
           --after is highly recommended because the attempt to  restore  very
           old  files  will  only  result  in them being hard linked to a more
           recently deleted file and as such pollute the output.

           Show all inodes that are shared by two or more files.

       --version, -[vV]
           Prints the version information and exits.

           Prints a help message and exits.


       Restoring all files from the ext3 partition/file /backup/sda1:
       ext3grep --restore-all /backup/sda1
       Listing the files owned by GID 1000 on /backup/sda1:
       ext3grep --ls --group 1000 /backup/sda1
       Finding all files containing the string Critical_report in  their  name
       on /backup/sda1:
       ext3grep --dump-names /backup/sda1 | grep ’Critical_report’


       Do  not attempt to use ext3grep for recovery from a mounted filesystem.

       No, not even then.

       ext3grep sometimes runs out of memory spare on 32-bit architectures and
       crashes.  It  is  highly  recommended that you run ext3grep in a 64-bit
       environment when dealing with large filesystems, though this is seen as
       a bug.

       ext3grep cannot recover files if there are no remnants of them.

       Some  files  that ext3grep recovers may have trailing null bytes - just
       scrape them off like the burnt bits on toast.




       ext3grep was written by Carlo Wood <>.

       This manual page was written by  Rich  Ercolani  <>,
       for  the  Debian  project  (but  may  be  used  by  others).  It may be
       distributed under the same terms as ext3grep, the  GNU  General  Public
       License, either version 2 or (at your option) any later version.